GitHub Advisoryadvisory · PyPI

GHSA-6qhv-4h7r-2g9m rfc3161-client has insufficient verification for timestamp response signatures

CRITICAL Published 2025-06-20 Modified 2025-06-27 Official page ↗
Aliases
CVE-2025-52556
Ecosystem
PyPI
Packages
rfc3161-client
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-347
Reviewed
2025-06-20

Affected packages

• PyPI rfc3161-client: < 1.0.3 → fixed in 1.0.3

Description

Impact `rfc3161-client` 1.0.2 and earlier contain a flaw in their timestamp response signature verification logic. In particular, it performs chain verification against the TSR's embedded certificates up to the trusted root(s), but fails to verify the TSR's own signature against the timestamping leaf certificates. Consequently, vulnerable versions perform insufficient signature validation to properly consider a TSR verified, as the attacker can introduce _any_ TSR signature so long as the embedded leaf chains up to some root TSA. Patches Users should immediately upgrade to `rfc3161-client` 1.0.3 or later. Workarounds There is no workaround possible. Users should immediately upgrade to a fixed version.

Related

Alias · CVE (1)

  • CVE-2025-52556 rfc3161-client is a Python library implementing the Time-Stamp Protocol (TSP) described in RFC 3161. vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References